Windows 7 forum: Fix It or Start Fresh?

Total posts: 9 (Showing page 1 of 1)

Thread display preference:
Collapsed
Expanded

Back to Windows 7

Tracked Track this thread

Answers

Answer Best answer as chosen by user BDaniPhotography

Try Grif's advice first.

by R. Proffitt - 12/9/12 12:51 PM

In Reply to: Fix It or Start Fresh? by BDaniPhotography

Might save a lot of time over the fresh start.

-> http://forums.cnet.com/7726-6132_102-5098912.html?tag=posts;msg5099421

Was this reply helpful? (0) (0)

Staff pick

I followed the instructions

by BDaniPhotography - 12/9/12 1:38 PM

In Reply to: Try Grif's advice first. by R. Proffitt

I followed the instructions from the post in your link, but I don't see any difference in the performance of my laptop. What is my next step?

Was this reply helpful? (0) (0)

Staff pick

Did RKILL find anything?

by R. Proffitt - 12/9/12 2:34 PM

In Reply to: I followed the instructions by BDaniPhotography

It's the rare machine that didn't cough up a clue with those scans.

There is also the issue of performance robbing apps or "toxic combinations." As I only have what you share, your choice to tell all. For example a HIJACKTHIS log could reveal some combos I know of and then you can consider the r580's factory restore options.

This model has different restores available based on the user's choices when they boot the machine. I can't tell which option you used or if you created the restore media in case it all went south.
Bob

Was this reply helpful? (0) (0)

Staff pick

Malwarebytes Scan

by BDaniPhotography - 12/10/12 3:04 PM

In Reply to: Did RKILL find anything? by R. Proffitt

Below, I have inserted the log of a full Malwarebytes scan to see if anyone can make sense of it for me and tell me what I can do. After this post, I will try removing the six threats Malware identified and restart my computer, but I don't think it will do any good.

Malwarebytes Anti-Malware (PRO) 1.65.1.1000
www.malwarebytes.org

Database version: v2012.12.09.05

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Brittany :: BRITTANY-PC [administrator]

Protection: Enabled

12/10/2012 3:06:48 PM
mbam-log-2012-12-10 (16-35-34).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 480856
Time elapsed: 1 hour(s), 6 minute(s), 38 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 6
C:\Windows\assembly\tmp\U\00000001.@ (Rootkit.0Access) -> No action taken.
C:\Windows\assembly\tmp\U\000000cf.@ (Trojan.Agent) -> No action taken.
C:\Windows\assembly\tmp\U\800000c0.@ (Rootkit.0Access) -> No action taken.
C:\Windows\assembly\tmp\U\800000cf.@ (Rootkit.0Access) -> No action taken.
C:\Users\Brittany\AppData\Local\Temp\{E9C1E1AC-C9B2-4c85-94DE-9C1518918D02}.tlb (Rootkit.Zeroaccess) -> No action taken.
C:\Windows\Temp\{E9C1E1AC-C9B2-4c85-94DE-9C1518918D02}.tlb (Rootkit.Zeroaccess) -> No action taken.

(end)

Was this reply helpful? (0) (0)

Staff pick

You found a RootKit. Zeroaccess

by R. Proffitt - 12/10/12 3:09 PM

In Reply to: Malwarebytes Scan by BDaniPhotography

Sadly you can see the responses I got at the next link. I had hoped that some progress had been made on this nasty.

http://forums.cnet.com/7723-6132_102-578886/zeroaccess-rootkit-symptoms-found/?tag=contentBody;threadListing

I STRONGLY ADVISE you make sure that any files you want to save are safely out of reach of this PC along with a backup copy (that's TWO COPIES!)

-> If you are paying for Norton or such, ask them for their fixes.
Bob

Was this reply helpful? (0) (0)

Staff pick

I need clarification.

by BDaniPhotography - 12/10/12 5:45 PM

In Reply to: You found a RootKit. Zeroaccess by R. Proffitt

I read the thread you linked to, but I don't understand how to fix the problems with my laptop. I am not paying Norton or anything like that, so I cannot ask them to fix the problems for me. Is there more information that I could provide to find a solution?

Was this reply helpful? (0) (0)

Staff pick

Sorry but this rootkit is the worst I've encountered.

by R. Proffitt - 12/10/12 5:50 PM

In Reply to: I need clarification. by BDaniPhotography

Why? Because without a full Windows 7 DVD (Retail!) any method I would use does not help anyone.

I've alerted those I know to chime in and I'm a little puzzled that you didn't use that new search engine called google, ask, duckduckgo or yahoo to learn more about this and other rootkits.

You don't have to answer but is research like this is something we do when we get into a new area. I know I did that with Linux so why not here?
Bob

Was this reply helpful? (0) (0)

Staff pick

Answer Best answer as chosen by user BDaniPhotography

Fresh start is best ...

by tumbleweed_biff - 12/13/12 8:19 PM

In Reply to: Fix It or Start Fresh? by BDaniPhotography

I have always heard those things you are experiencing referred to as "browser hijackers" as they are hijacking your browser. The symptoms you descripe -> going to sales sites instead of desired location, slow browsing, pages unable to load, are all common to these pieces of malware.

Any time you become infected with malware, your best bet is a full wipe and load. Many pieces of malware either openly invite additional malware or at least open the door for more to come in, so odds are you have multiple infections. No AV product gets every piece of malware. I run Panda Cloud along with Threatfire on an 'ALWAYS ON' basis and routinely run Malwarebytes as a manual scan.

If you don't want to do a fresh load, then you can try running Spybot Search and Destroy along with some other AV tools. You should run at least one stand alone bootable AV product from outside of Windows, preferably 2, in addition to running at least one within windows. Kaspersky, Panda, and several others all make a free bootable tool you can use.

Your Malwarebytes scan looked like it found some things but it didn't repair them and you should run it again, instructing it to repair/delete anything found.

Your safest bet, however, is to offload your data onto a backup device (DVD/external HDD/etc.) and then reload Windows. Before the machine connects to a network/internet, you should install your desired AV program along with its current database version. You should then run Windows Update until you are told there are no updates. You will probably have to reboot at least 3 times during this.

Once you have AV installed, up to date, and Windows is updated, SCAN your data backup and then load it back on to your machine, along with installing any other programs you need. Once your system is configured to your liking for day to day use and has all your data in place, create an image of the drive with which you can easily wipe and restore should the need arise. Marium offers a free version of their Reflect program which is very easy to use for this purpose.

Next, practice safe hex. One of the best ways for you to do this is to make sure that you are using a standard account and not an administrator account, to do your day to day computing.

The 3 most common sources of malware on the internet: gambling sites, porn sites, and warez sites (so-called "file-sharing" of copyright protected software like piratebay and uTorrent).

1) If you have enough money you can afford to lose it gambling, please send it to me, because I need it, desperately.

2) You shouldn't steal software. There is enough free stuff out there to do just about anything you need anyway (check out Sourceforge, for example) and programmers deserve to get make a living on their work, just like a carpenter, a pipe-fitter, or an accountant.

3) Finally, porn has been proven to have a very negative effect on society, ethics, morals, and relationships, so you should really try to be strong and avoid it.

Was this reply helpful? (0) (0)

Staff pick